Agent skill · security · yaklang
active-directory-acl-abuse
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
Why this skill is useful
Adds detailed exploitation scripts and techniques for Active Directory ACL abuse that are not commonly known or documented.
What it needs
Requires bloodhound, pywhisker, sharphound, whisker installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: AD ACL Abuse — Expert Attack Playbook AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns. 0. RELATED ROUTING Before going deep, consider loading: active-directory-kerberos-attacks for Kerberos attacks often chained with ACL abuse active-directory-certificate-services for certificate-based attacks after ACL exploitation ntlm-relay-coercion for relay attacks that can set ACLs (LDAP relay) windows-lateral-movement after gaining elevated AD access Advanced Reference Also load BLOODHOUNDPATHS.md when you need: Common BloodHound attack paths with Cypher queries Custom Neo4j queries for finding complex chains Data collection and ingestion tips --- 1. BLOODHOUND ENUMERATION Data Collection Key BloodHound Queries (Built-in) "Find all Domain Admins" "Shortest Paths to Domain Admins from Owned Principals" "Find Principals with DCSync Rights" "Shortest Paths to Unconstrained Delegation Systems" "Find computers where Domain Users are Local Admin" --- 2. DANGEROUS ACE TYPES ACE Effect on Users Effect on Groups Effect on Computers --- --- --- --- GenericAll Change password, set SPN, modify attributes Add members RBCD, LAPS read, all attributes GenericWrite Set SPN, modify attributes, shadow creds Add members RBCD, shadow credentials WriteDACL Grant yourself any permission Same Same WriteOwner Take ownership → then WriteDACL Same Same ForceChangePassword Reset password without knowing old N/A N/A AddMember N/A Add self/others to group N/A AllExtendedRights Force change password, read LAPS N/A Read LAPS, BitLocker keys ReadLAPSPassword N/A N/A Read local admin password WriteSPN Set SPN → targeted kerberoast N/A N/A --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/active-directory-acl-abuse